CVE-2026-62986

Name of the Vulnerable Software and Affected Versions OpenEXR versions 3.3.0 through 3.3.12 OpenEXR versions 3.4.0 through 3.4.13

Description The PyOpenEXR Python bindings return stale heap data when reading a specially crafted deep scanline EXR file that utilizes layer-prefixed RGB channels. When using default channel coalescing (where separate channels is set to False), the wrapper groups channels like left.R, left.G, and left.B into a single RGB sample array. However, the lane-offset calculation in the setDeepSliceData() function only recognizes the exact unprefixed names G, B, and A. Consequently, prefixed channels such as left.G and left.B are decoded into lane 0, leaving lanes 1 and 2 uninitialized. A Python application using the default OpenEXR.File API to read untrusted deep EXR files may expose uninitialized same-process heap contents when processing the resulting NumPy sample arrays, while also receiving incorrect green and blue channel data.

Recommendations Update OpenEXR versions 3.3.0 through 3.3.12 to version 3.3.13. Update OpenEXR versions 3.4.0 through 3.4.13 to version 3.4.14.